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iPhone target analysis and exploitation with unique 

device identifiers 



This paper describes standard analysis techniques 
that have been used to both discover iPhone 
target end point machines and implant target 
iPhones directly using the QUANTUM system. It 
shows that the iPhone Unique Device Identifier 
(UDID) can be used for target tracking and can be 
used to correlate with end point machines and 
target phone. It highlights the exploits currently 
available and the CNE process to enable further 
targeting. 
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B. BACKGROUND 

1. Every Apple iPhone, iPad and iPod touch has a unique hardware 
identifier called the Apple UDID. The UDID is a 40 character hex string 
(160 bits) that seems to be a SHA-1 hash of the IMEI, serial number and 
the Bluetooth and WiFi MAC addresses. The UDID is available to 
developers of applications for these devices, and it is used to identify a 
given device. As highlighted in [a], the UDID is seen in multiple apps and 
can be used to allow target tracking or be used to correlate with other 
personal identifiers. 

2. The Mobile Theme has invested a large amount of research into iPhone 
apps and metadata analysi^ver the last year accumulating with a 
detailed report done by|H[c] in October 2009 and 29 SEM rules 
created by ICTR-MCT [b]. These rules have used to extract iPhone 
metadata for a number of apps and in particular the Unique Device 
Identifier (UDID) from any carrier being processed using DEBIT CARDS. 
Further TDI rules are being developed by GTE that will in the future 
extract UDID events from carriers processed through the MVR system. 
The resulting events have then been used to populate both research and 
corporate QFDs (Query Focused Datasets) such as MUTANT BROTH 
and AUTOASSOC and will eventually form the basis of mobile 
correlations in HARD ASSOC. 

3. Initially, an exploit was developed by the Joint CNE/TECA Mobile 
Exploitation Team for iPhone that was to be delivered to the target 
phone when syncing with an exploited end point machine. This was 
successful for a BROKER target and resulted in the extraction of SMS, 
call logs and contact details. After this initial trial, CNE and SD undertook 
work to discover other single end points seen syncing with iPhones. 

4. At HANDEX 2010 (handset exploitation workshop) in August, various 
aspects of the iPhone OS were investigated for potential vulnerabilities. 
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Using an open source PDF vulnerability when using the Safari browser, 
Joint CNE/TECA Mobile Exploitation Team were able to develop an 
exploit to deliver a WARRIORPRIDE implant to a target test phone. 
Further, investigation, liaison and testing with the CNE QUANTUM team 
resulted in approval for the implant to be deployed against QUANTUM 
iPhone targets. 



C. DESCRIPTION OF ANALYSIS 

CNE Endpoint 

5. As part of the SD Mobile Exploitation theme to identify further end point 
machines that had been seen syncing with iPhones, a survey was 
undertaken by CNE and TAO to scan all target end point machines for 
the appropriate iPhone registry keys. Scanning of all CNE stored single 
end point (SEPs) registry keys on particular process IDs resulted in 9 
CNE endpoints seen this year sync’d with iPhones. The resulting Unique 
Device Identifiers (UDID) were extracted from the registry keys and ran 
in MUTANT BROTH and AUTOASSOC, resulting in 6 correlations with 
either iPhone Safari user agents or the iPhone Mail app seen in passive 
collection. 

6. A CNE end point operation against SOLI NE 
EPI^ONWiad resulted in access to a windows end point machine 
^^^^^^B^^carMjnhi^Tiachine^aqist^ resulted in UDID 

As can be seen, the 

UDID has been seen with the Admob SEM rule type and with the Apple- 
IMEI-URI TDI type. Admob is the largest mobile advertising network 
allowing games publishers to embed adverts and therefore receive 
revenue from a number of different brands. The target iPhone OS is 3_0 
as shown in the User Agent profile in figure 2. 



TDI type TDI value 

g EKP_Admob-isu-UFU 
|^7| EAUTO_Apple-imei-URI 
1^7] EXP_Admob-X-Admob-Isu 

Figure 1 - MUTANT BROTH Matching Identifiers 

TDI User- Agent 




Event Count 
(%J 



Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; HW iPhonel.2; en-u«) AppleWebKit/525.18.1 3 (18 %) 

(ICHTML. like Gecko) (AdMah-ISDK-20090203) 

iPhone Mail (7A341) 11(69%) 

rtozllla/5.0 (iPhone; U; CPU IPhone OS 3_0 like Mac 05 X; HW lPhonel.2; en_us) AppleWebKit/SZS.lQ.l 2 (12 %) 

(KHTML, like Gecko) (AdMob iSDK 20090609) 



Figure 2 




iPhone UDID User agent profile 
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7 . 



The target UDID can be used track the iPhone seen with ASBOLINE 
EPILSON end point machine. In this particula^as^h^arae^DiD has 
been seen 16 times, the last time off on the 

24/10/10 using the inbuilt iPhone Mail client to access his yahoo 
account. The user agent for this is shown in Figure 3. In this case the 
EAUTO_Apple-imei-URI TDI rule was used to extract the specific UDID 
value. 



TDI-Scope Auto Route 
User-Agent iPhone Mail (7A341) 

Labelled-Ro ute 



Figure 3 - iPhone Mail client user agent 



Bearer Sigad Pddg Ssdg Other Info 



8 . 



GWVCB0G1 



TDI-Scope Ma chine Route 

C P C_D E E IT CARD 
Format-Transform SEM->TDI 
User-Aqent Mozilla/5,0 (iPhone; U; CPU 
iPhone OS 3_0 like Mac OS X; HW 
iPhonel^; en_us) AppleWebKit/525.18 .1 
(KHTML, like Gecko) (AdMob- 
iSDK-20090609) AS-IP-Src NO_MATCH 



Figure 4 - iPhone Admob user agent profile 



The UDID for a ll 6 targets were run through AUTOASSOC. The result for 
is s hown in Figure 5. As can be seen there is a clear 
correlation with the yahoo-Y-cookie. 



Known TDI 



I XP Admob-i^u UR1: 



EXP Admob-X -Admob- Isu: 



Putative TDI 



Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie; 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 
Yahoo-Y-Cookie: 

<P Admob-X -Admob-Isu, 




EXP_Admob -isu- URI: 



CORINTH 

tasking? 



Score Events 



1.000 13 

0.500 1 

O.SOO 1 

0.500 1 

0.500 1 

0.500 1 

0.500 1 

0.500 1 

0.500 1 

O.SOO 1 

0.500 1 

0.500 1 

0.500 1 



Figure 5 - AUTOASSOC results for ABSOLINE EPSILON 

9. The IP address, identifier type, bearer and user agent type for all 6 

targets was extracted and formed the basis of further target development 
work. Running the resulting 6 UDIDs through AUTOAS SOC, resulted in 
two correlations with a high enough score. These were HHHHH 
and and confirmed to be correct after discussing with 



Most 

recent 

24 / 10/10 

23 / 08/10 

14 / 11/09 

14 / 11/09 

19 / 06/10 

10 / 12/09 

19 / 08/10 

23 / 08/10 

10 / 12/09 

19 / 06/10 

15 / 11/09 

19 / 09/10 

19 / 09/10 
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Checking BROADOAK tasking revealed that both targets 
had known associated iPhone IMEIs already tasked. 

10. A recent rescan of all currently active CNE SEPs resulted in only 5 of the 
9 identified CNE machines actually being available for exploit. The other 
4 implants having been removed. Of these five UDIDs, four returned with 
correlated UDIDs that had recently been seen in passive collection. 
These are contained in the iPhone target list [f]. 

11. Analysis of all TAO SEPs resulted in 116 UDIDs being identified. Of 
these UDIDs, 15 were correlated with iPhone user agents and the 
resulting identifier type, project name, case notation and IP noted. A full 
list is available in the iPhone target list [f]. Of these four had the Cydia 
user agent as shown in Figure 6 indicatin g the targ et had jailbroken their 
phone. All four end points were located in^^^^|. 



TDI-Scope Ma chine Route 

Source CPC JDEBITCARD 
Format-Transform SEM->TDI 
User- Agent Mozilla/5.0 RockApp/2.60,1. 
(iPhone: u; CPU like Cydia/i. 0,3172-68) 
AppleWebKit/51B.18 (KHTML, likes Gecko) 
Version/4 ,0 Nobile /7Dll Safa ri/528,1 6 
AS-IP-Src ■■ 

La belled - Ru u te 




EF07C8000 0000000 0000000 CO 000000 020 



Figure 6 - iPhone jailbroken user agent in MUTANT BROTH 

12. The same 15 TAO UDIDs were run through AUT OASSOC and resulted 

inthreeaoodco^ y ahoo selectors 

These were in 

turn confirmed to be correct correlations with TAO target end points and 
two showed associated target iPhone IMEIs. Further, analysis of the 
Yahoo mail used via the Safari browser clearly showed the resulting 
UDID was transmitted in traffic. 

13. One of these TAO end point machines, SOLARSHOCK116 
^^^^^^^^^^^^^^JranianjjTa^eer^eet^yncing with iPhone 

was 

with ng 

A^TOASSOCJt^UDID was last seen on 23/10/10 at 03:46:36z on 

using the EAUTO_Apple-imei-URI TDI. 






Pvtatrv* TCI 




O 9KJNIH 
fas Jang? 



Most 

recenr 



1.000 33 73/10/10 
1 000 Si 73/1 0/10 
0.636 2 79/01/10 
0 500 1 23/06/10 
0 500 1 75/06/10 
O.bUO 1 2U/ia/U9 
0.500 1 21/10/10 
0 500 1 73/06/10 



Cetsit 



0 

[d 

EJ 



FI 



0 

fcl 

0 



Figure 7- SOLARSHOCK116 UDID AUTOASSOC correlations 
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QUANTUM EXPLOIT 

14. After extensive testing of the QUANTUM tipping and redirection to the 
SHORTSHEET exploitation server by the Joint CNE/TECA Mobile 
Exploitation Team, further target development work was needed to 
identify iPhone targets recently seen active on the appropriate user 
agents. Bulk extraction of targets over a three-week period from 
BLACKHOLE by ICTR resulted in a large number of iPhone targets and 
further queries in Xkeyscore resulted in others. Others were passed from 
discussions with various IPTs and two were also passed from TAO 
contacts. 

15. In total 44 selectors were checked to verify that the correct user agent 
was present. Of these 44 selectors, 41 were yahoo selectors and 3 gmail 
selectors. Of these 26 were seen with a valid iPhone Safari user agent 
as shown in Figure 8. A summary of OS versions seen with target 
phones is shown in Table 1 with OS highlighted in red currently 
exploited. These are 3_1_2, 3_1_3 and 4_0_1. In all 26 cases, the target 
analysts were contacted with details regarding their targets use of an 
exploitable iPhone. 



iPhone OS 


Number 


3_0 


4 


3_1 


2 


3_1_2 


6 


3_1_3 


15 


4_0 


3 


4_0_1 


5 


4_0_2 


1 



Table 1 - iPhone target OS summary 

24. One par ticular case was a^^^B target, with yahoo 
selector ^^^^^m^^^^that was seen active on a iPhone OS 
3_1_2, as shown in Figure 8. The resulting Yahoo-B cookie is 
^^^■^^^■ancUi^arUj^eenthetarget has been active off 

Running the resulting Yahoo- 

B cookie through MUTANT BROTH resulted in 171 events primarily on 
case notations GWUKG005, GWVCB003 and IRUKC036. The resulting 
information was then forwarded to the analysts in the^^^|team for 
tasking by the standard ONE process as outlined in the Good 
Penetration Guide [d]. 



Page 6 of 11 

TOP SECRET STRAP1 





TOP SECRET STRAP1 



12 th November 2010 



|Sourcc CPC_DEBITCARD Format Trarrafi 

^er-Agent Mozilla/B .0 (iPhone; U; CPU iPhone OS 3_1_2 like M ac OS X; en-us) 
^■afats^RiTnrr in r.n MiM^rrH 



t cj 1 1 o o C. L uok if- Ytihoo Y Cookie 

teWebrWEZB.iB (KHTML,TK^Gecko^ersion/4.0 Mobile/7Dll 
■ hvent-CSL EF07C6 Stream-CSL EF07C8 



TD^Scopc Machine Route Source CPC_DEBITCARD rormat Transform SEM->TDI Yahoo D C ookic ahao Y Cookie 

^S^|llser Agent Moiilla/5.0 (iPhone; U; CPU iPhone OS 3_1_2 like M ac OS X; en-us) AppleWebKrt/528.18 (KHTML, lik^Geoco^ereiorv4.0 Mobile/7Dll 
Safari/520.16 AS IP-5rc NO MATCH AS-IP-Dst ■■ Labelled Route Event-CSL EF07C6 Stream-CSL EF07C8 



TDI Scope Machine Route ser Agont MozHla/ 5.0 (iPho ne; U; CPU iPhon e OS 3 1 2 like M ac OS X; en-us) AppleWebKil/528.18 (KHTML, like 

Gecko) Version/4.0 Mobile/7Dll Safari/528.16 Yaboo-Y-lookle Yahoo-8-Cookie^^Hm||^ahoo- I-tookie 

2“59mjMB5RQoMBZVB0SvGskx/M2l2BjY3NjU2M2RQMD8-&a“YAE&sk-DAAYIXEBDZnNKU&.k$=EAAkNKFiJQutIRDCfXj7r)GYag E& 

d«c2wBTknVMEFURXdNVEl4TLRNNUSEZyDBYQFZQUUBZwFFNTdKTlpXMlFNSExGQTdQUORORlBGQUg2TQFvawFaVzAtAXp6ATU5bWpNQkE3RQFDaXABQlI4VjND8i 
af=QXdBQjFOJnRzPTEvOOQOMDMi*NjUmcHM9UVRkYXF2YVUtWai54UUZUWndm2IM2yOt Yahoo- Y- Cookie-Full v=i&n=abqik0qdvtkfn&l=c0j)048/o& 
p=mzm00OOQl3C0Q0OO8v=89&lg=en-usetintl=us8inp=i Event-security-label 10007F Stream-security-labef 4000Z3ECFF 

TDI-Scope User Rnnt^^^^^^^^Buser-Agent Mo;illa/5.0 (iPhone; U; CPU iPhone O S 3_1_2 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like 
Gecko) Version/4.0 Mobile/7Dll Sefar/528.16 Yahoo-Y-tookieHIH Yahoo-B-Cookir ^^■^^^^^■Yahoo-T-Cookie 

,«50 m ,MnCD r;nMn7UHnc^cL-v/r.M7ft.Y J 5M,ll>M7DnMTO.«„-VArc J I _riAAVTvCB.m'7r.MVII(l,lrcJPffiCfw!W7Wl)nrfV.7r.rt^ J .r 1 Pft. 



Figure 8 -Valid iPhone Safari user agent in MB ( 




yahoo>) 



25. 



The target wi th target selector 

seen active on different iPhone OS 

and more recently on an iPad. Three other targets were seen active on 
iPads and two others on iPods but with no other associated iPhone 
device. Of the 44 targets seen, 16 were seen using the iPhone Mail 
client that comes by default with all OS. A total of 7 targets were seen 
using the Yahoo Mobile Messenger app. 



26. For all target selectors seen with valid Safari user-agents, further 

MUTANT BROTH, AUTOASSOC and MARINA queries were performed 
to discover any other possible OS versions seen with the selector. 
MARINA profile queries were performed resulting in the OS version 
being returned within the MachinelD field. The resulting user-agents, 
time/date, bearer, IP and any other associated selectors are shown in 
the iPhone target list [f]. Associated selectors are either from MUTANT 
BROTH, AUTOASSOC or seen directly as stated in BROADOAK. All 
Yahoo B-cookies as shown in Figure 8 were run in MUTANT BROTH to 
confirm their uniqueness with the iPhone and target yahoo selectors. 



D. OPERATIONAL OUTCOME 



27. The QUANTUM redirect and PDF Safari browser exploit was developed 
to work against 3_1_2, 3_1_3 and 4_0_1 Safari OS versions. Of the 26 
targets seen with valid exploitable OS version, 5 were added to the 
QUANTUM system for targetting. 



28. 



29. 



Once notified, GCHQ IPTs either added the target to existing ONE 
section 7 warrants as defined in [e] or developed targetting aids as 
defined in [d] and wrote the appropriate warrant. The resulting section 7 
warrants were approved by IPT team leaders and signed off by the ONE 
Legal Team. Three NSA targets were discovered and were added by 
ONE Legal Team to the Partner Agreement Forms to allow exploitation. 




Initially, 



and B- 
was not seen 



yahoo selector 

cookie was put on cover on QUANTUM. | 
active recently on a iPhone Safari browser to access his yahoo account, 
preferring instead to use the inbuilt iPhone Mail client or his iPad. Three 
QUANTUM attempts resulted in no redirect to SHORTSHEET server for 
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^^■and after further analysis it was discovered that this selector was 
not^^Hbut an associate. It was removed from tasking. 

30. Target analysis and warrant was completed for a further five targets and 
a successful Q UANTUM redirect and the PDF exploit was delivered for 

PFVT658) on the 30th of October. The resulting 
WARRIORPRIDE install was also performed and beaconed on the 2 nd of 
November. The target phone was shown to be jailbroken and on the 3 rd 
of November content was successfully extracted from the phone and 
was available in Looking Glass. This is highlighted in Appendix B with 
the resulting iPhone directory structure presented how it appears in 
Looking Glass. The WARRIORPRIDE exploit has resulted in extraction 
of the target’s address book, sms, call logs, notes, WLAN logs, 
bookmarks, map query history, Safari browsing history and some 
images. Detailed analysis of extracted files will be covered in a further 
report. 

31. A successful redirect to in October was 

performed but due to what is believed to be Javascript being disabled on 
the phone the firmware type of the phone could not be confirmed to 
enable the first stage implant. This initial survey of the firmware type has 
now been removed after discussions within ONE but the target has not 
been seen recently on his iPhone for exploitation. The two other targets 
tasked for QUANTUM have failed to be seen recently in collect. 

32. Currently, there are four CNE Single End Point machines that have been 
identified with recently sync’d iPhone targets. The most recent being an 
OVERLIT target seen on 29/09/10. These targets are being monitored 
by CNE and will have the SLIDE exploit installed to allow implant of 
WARRIORPRIDE when the iPhone is sync’d with the existing SEP 
machine. 

E. CONCLUSION 

33. With the analysis of the UDIDs on target machines and correlation in 
passive collection with known target yahoo selectors, the UDID can be 
used to correlate iPhone handset to end point sync machine and tasked 
yahoo selectors. The UDID can be used for realtime tracking of target 
iPhones and could in theory be used as a selector for QUANTUM events 
where other traditional selectors (yahoo- Y/B cookie etc) are not present. 
Of course an exploit for the application would have to be written which is 
not trivial. 

34. It is not possible at this time to take the UDID and reverse engineer the 
SHA-1 HASH to discover the IMEI, MAC addresses and serial number. 

35. Further work is ongoing to identify targets of interest that are suitable for 
the QUANTUM exploitation. Development and monitoring of current 
identifiedtarqets is still being done. Discovery of an associated IMEI for 

will help in firmware identification and exploitation of this 

target. 
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36. CNE are now conducting monthly surveys of all target machines registry 
keys for iPhone UDIDs. A similar tipping mechanism for all BROADOAK 
hits needs to be completed using a XKS workflow. Hopefully, other 
targets will be added for QUANTUM exploitation or discovered on new 
CNE SEPs in the future and a successful exploit of a target phone 
performed. 

F. FURTHER WORK 



37. Analysis of three PRESTON accesses has resulted in the identification 
of a number of iPhone targets. Development work against at least three 
target sets is needed with extraction of appropriate UDIDs and iTunes 
XDSID values. Suitable section 5 warrants need to be in place to pursue 
these end point machines, once CNE have gained access and the 
resulting target iPhones have been discovered. 

38. With further work being undertaken by BSS and TECA on the 
WHIPSAW redirect and exploitation server, it should be possible in the 
coming months to implant directly the target iPhone. However, the 
WHIPSAW exploit is only available via the tasked ADSL line. 

39. An automatic implantation of SLIDE on to an iPhone is needed. 

Currently this is manual process requiring a CNE operator to be 
connected to the endpoint machine whilst the target is syncing the end 
point machine and iPhone. 

40. A larger number of iPhone TDIs need to be written to allow further 
events to be populated into the QFDs allowing correlations with other 
target selectors. This will also enable further real-time tracking of target 
identifiers. 
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APPENDIX B 



Looking Glass iPhone directory structure 



\lib'ary\preferences\systenconfigiration 



cb IS / va/mobilefmedio/dcimf 1 00op|de/img_04 1 E . jpc 

® [S / var /mobilstmedia/dcimt 1 00apple/img_04 1 9 . jpc 

ffi Eh 

QB bin 
& dev 

j S fe library 

i 0 presences 

sys:emconfiguration 

i S fc> private 
: CD vor 

Q fe- £ys:em 
| 1=1 & lihrary 

Si (& appleptp 

ffi & appleusbdevlce 

ffi & aucio 

ffi & canes 

ffi (£> carrier bundles 

ffi coreservices 

ffi & dotaclossmigrotors 

ffi extansbns 

ffi Ffesyctemc 

ffi & fon:s 

ffi Frameworks 

ffi & internet plug-ins 

ffi & keyboa'ddictionaries 

ffi & launchcaemons 

ffi ^ lockdown 

ffl £> monogedccnfigjretonbundes 
$ £3- mediacaptcre 
ffi ^ prevarenrehi indies 
ffi privatefrarreworks 
ffi & putlishngbundlas 
ffi ^ searchbundes 
ffi & sprhgboardplugins 
ffi & sys:emconliguration 
ffi (& tex:input 
ffi videodecoders 
ffl fe- videoencoderc 
fl-feiw 

&bin 
QB sbiri 
0 & var 

& mobile 



_E_ 



ccm . apple . autowake . plist 
ccm . apple . network. identiF icat on . plist 
j rrm. apple. wiF.pikt 
net wcrkin:erFaces. plist 
pneFerencas. plist 



I I I 

L ' 
L 

Li ' 



034. 0D 
20.22KE 
iR.nikTF 
1.35KB 
16.16KE 



PLIST File 
PI T5T File 



Pall i 

. . \libiar/\priFeiences\ . . . 
. . \librarv\praFerences\ . . . 
. . \lihrarv\pr=FfinRnrfi‘:\ . . . 
. . \Hbrarv\praFerences\ . . . 
. . \Hbrarv\praFerences\ . . . 



returned files 




Dale MuUiFitd 
01 -Jan- 1300 00;... 
03-NOV-2010 17... 
fl3-IVInv-7ni fl 1 7.. . 
01 -Jan- 1300 00:... 
03-NOV-201017... 



1 



File Searcher 



» Set Seaicl Pdrdiielers 



^ Mad Pica ton time 

deFault v| 


r Creadon time 

defaut: [v] 


r accessed lima 

deFadt: v 


I'-Files 3.e:rieved 

□ defadt: v 


after 11/11/2000 g| 


after ll/:l|2000 t 


aftar ll/ll, '2C0C v 


aFter 


npFn tvr/7nin g| 


up -n | ii/- ij?nin g 


npFn 11 /n, '?nr g 


iptn 1 11/1 1;; 


'Fie SUe (n KB) 


'Text ii dll/pail uf filename: 




defadt- |* 


1 1 


1 Scorch] 


mb | 0| 


Specify Path: 


530 File(s) Found 


max 9007 1992547409?! 


r i 





Worning: Mardmum soorch 
result reached (500). 

Try o ino e spsci : ic search 



Mane 


1 1 1 


fi^t 


File Type 


Fall 


Dole Mudfied 




Date Cealed Link Ter y el 


StdljS 


Dale Received 


H cdcressbook.sgltedb 


L r 


236.0KB 




... \briyate\va'\mobile\... 


Jl-Jan-1800 00 




Jl-Jan-1830 OC:... 


RECEIVED 


02/11/10 L3:0£ 


§ edcressbook.sqltedb 


m y 


230.0KD 




... \privete\verynab letyi . . . 


31-Jen-1000 00 




Jl-Jan-lOJO OC;... 


RCCCIVID 


02/11/10 tO;OC 


H sms.dD 


M. v 


88.0KB 




... \\3riyate\va'\mobile\... 


Jl-Jan-1800 00 




Jl-Jan-18J00C:.„ 


RECEIVED 


02/11/10 13:06 


□ sms. do 








\private\varynableVi... Jl-Jan-1800 00 


... 


Jl-Jan-18J0 OC:... 


RECEIVED | 


02/11/10 16:36 SB 


i ] (juni.t^jpe.-uiniiLe iler .pliil 


■ ™ 


134. OB 




... \\xa\niubilediLray\... 


31-Jd 1-1800 00 




Jl-Jdi i-l 8 JO OC;... 


RECEIVED 


02/11/10 13:06 


§ com. appe.:omrrce3ter. plist 


L 


134. 0B 




... \var^moble\ibrary\p.. 


Jl-Jan-1800 00 




Jl-Jan-1830 OC:... 


RECEIVED 


02/11/10 16:36 


[B com. appe. wifi, plist 


■ ^ 


14.9KB 




... \\ibrarv\pre : ererces... 


31-Jan-1800 00 




Jl-Jan-1830 OC:... 


RECEIVED 


03/11/10 17:12 


B com. appe. wifi, plist 


m r 


15.01KB 


PLIST File 


... \brary^pref2rences\... 


38-NO V-2010 17 




30-NO V-2C10 17.. 


RECEIVED 


00/11/10 17:11 


i com . app e . mcbilesafari . plist 


L 


1.23KB 




... \Wa'\mobileditra'y\. . . 


Jl-Jan-1800 00 




Jl-Jan-1830 0C:.„ 


RECEIVED 


02/11/10 13:06 


com . cpp c . mobilcsoFcri . plist 


L 


1.23KB 




... \vor ymoblc\ ibror y\p . . 


31 Jen 1800 00 




31 Jon 1830 OC:... 


RECEIVED 


02/11/10 16:36 


B com. app e. youtube. pist 


L 


lbb.Ub 




... Wa'\mobileditra'y\. . . 


Ji -Jan-i auu uu 




Ji-Jan-ituu uu... 


KtCtlViD 


U2/11/1U 13:U6 


[1 com. appe, youtube, pist 


L ' 


166 ,0B 




... \vartmoble\ibrary\p.. 


Jl-Jan-1800 00 




Jl-Jan-1830 OC:... 


RECEIVED 


02/11/10 16:36 


B com. appe. accountsettirgs. pist 


M y 


2.27KD 




... \\xa\mobileditray\. . . 


31-Jen-1000 00 




Jl-Jan-lOJO OC;... 


RECEIVED 


02/11/10 10:06 


B com. app e.accountsettirgs, pist 


ft y 


2.27KB 




... \varimoble\ibrary\p.. 


Jl-Jan-1800 00 




Jl-Jan-18J00C:.„ 


RECEIVED 


02/11/10 16:36 


com . app e . maps, plist 


L 


1.12KB 




... Wa'\mobileditra'y\... 


Jl-Jan-1800 00 




Jl-Jan-18J0 OC:... 


RECEIVED 


02 / 11/10 13:06 


[ j uum.c^jpe. in^js.plbl 


L 


1.12KB 




... \var p nuble\ ibrar y\p . . 


31-Jd 1-1800 00 




Jl-Jdi i-l 8 JO OC;... 


RECEIVED 


02/11/10 16:36 


B com . app e . jref erences . datet me . plist 


L 


100 .0B 




... Wa'\mobileOitra'y\. ■■ 


Jl-Jan-1800 00 




Jl-Jan-1830 0C:.„ 


RECEIVED 


02/11/10 13:06 


B com . app e . oreFerences . datet me . plist 


M y 


100. OB 




... \varynobie\ ibrary\p . . 


Jl-Jan-1800 00 




Jl-Jan-18J0 OC:... 


RECEIVED 


02/11/10 16:36 


B com. appe. weather. pist 


m y 


1.0KB 




... \var\moble\lbrary\p.. 


Jl-Jan-1800 oo 




Ji-Jan-i8J0 oc:.„ 


RECEIVED 


02/11/10 18:36 


com . app e . mcbilephone .sertinqs . pist 


L y 


88.06 




... \Wa'\mobileditra'y\. . . 


Jl-Jan-1800 00 




Jl-Jan-1830 OC:... 


RECEIVED 


02/11/10 13:06 


B com. cpp c.woothcr. pist 


L 


1.0KB 




... \\v , o'\mobilcditro'y\. .. 


31 Jen 1800 00 




31 Jon 1830 OC:... 


RECEIVED 


02/11/10 13:06 


1 com . app e . mcbilephone .seitings . p ist 


L 


B8.UB 




... \varimobie\ibrary\p.. 


Ji-Jan-iauu uu 




Ji-Jan-idJU uu... 


KtCtlViD 


U2/11/1U 16:36 


B IfiYRrra _ja Jn-rlynamr-hfixt . rat 


■ y 


0.0R 




... \\>;a'\mnhilfiditra'y\. . . 


31 -lan-1 Finn 00 




31 -lan-1 830 01":... 


RFCFTV r D 


(37/11 /in 13:06 


B cr-dynonic-text det 


M y 


2.41KD 




... \\xa\mobiledibay\... 


31-Jcn-1000 00 




Jl-Jan-lOJO OC;... 


RECEIVED 


02/11/10 13:06 


[ j ar-dynanic-text dat 


M v 


2.41KB 




... \var^moble\ibrar/\k. .. 


Jl-Jan-1800 00 




Jl-Jan-18J0 OC:... 


RECEIVED 


02/11/10 16:36 


B cyramic-text.dat 


L 


18.93KB 




... Wa'\mobileditra-y \. . . 


Jl-Jan-1800 00 




Jl-Jan-18J0 OC:... 


RECEIVED 


02/11/10 13:06 


B vyi aniiL-lexl.Lidl 


L 


18.9SKB 




... \varpnuble\ibrary\k... 


31-Jd 1-1800 00 




31-Jdi i-l 8 JO OC;... 


RECEIVED 


02/11/10 16:36 


B te Jl-dynanic-text.dat 


L 


170. 0B 




... Wa'\mobileilitra'y\. . . 


Jl-Jan-1800 00 




Jl-Jan-18J00C:.„ 


RECEIVED 


02/11/10 13:06 


B rotas dt 


M y 


32.0KB 




... \\v , a'\mobileditra'y\. . . 


Jl-Jan-1800 00 




Jl-Jan-18J0 OC:... 


RECEIVED 


02 / 11/10 13:06 


B te jl-dynanic-text.dat 


ll y 


170 .0B 




... \var^moble\lbrar/\k. .. 


Jl-Jan-1800 00 




Jl-Jan-l8J0 OC:... 


RECEIVED 


02/11/10 16:36 


Li rotas dt 


L 


32.0KB 




... \vanmoble\ibrary\n.. 


Jl-Jan-1800 00 




Jl-Jan-18J0 OC:... 


RECEIVED 


02/11/10 16:36 


B tocl<mor<s .plist 


L 


4.43KB 




... \\xo'\mobilcditro'y\. .. 


31 Jen 1800 00 




31 Jon 1830 OCi... 


RECEIVED 


02/11/10 13:06 



Page 11 of 11 

TOP SECRET STRAP1 





